The European Commission has adopted a new agreement allowing companies to resume the transfer of users' personal data across the Atlantic without needing to put in place special safeguards to keep that data safe. But privacy advocates say the new agreement—the third attempt at making data transfers GDPR-compliant—still violates European law.